SERS Retirement Board Technology Committee Agenda

Regular Meeting May 26, 2021

12:30 P.M. Click to join the Zoom meeting: https://ohsers.zoom.us/j/93678902339?pwd=Yk0xK09rdmhLQkhwblhoYUd6dmZ6UT09 Meeting ID: 936 7890 2339 Password: 633902 To join by phone, dial: (301) 715-8592 and enter the meeting ID: 936 7890 2339 and password: 633902 when prompted.

1. Roll Call

2. Technology Committee’s Purpose & Role

3. SERS Technology Delivery Footprint

o Information Technology Overview o SMART Overview o Information Security Overview

4. Upcoming Technology Committee Meetings

o Calendar Dates for Future Committee Meetings o Continued or New Business o Information Requests and Follow-up Items from May 26, 2021

Meeting o Future Topics

5. Adjournment (R)

05/26/2021

Technology Committee

Agenda - May 26, 2021

Technology Committee Strategic Intent

..So that Board has over-all business and technology strategy alignment, deeper awareness and understanding oftechnology direction, integration with information security and insight into long-term investment plan to sustainand evolve technology program at SERS.

Technology Committee Role

Provide a platform for staff to engage and collaborate with board members on information technology and security topics

Oversight and approval of information technology and security strategy and direction that aligns with SERS’ vision

Awareness of technology and information security trends, challenges, cost and risks

Guidance on multi-year technology investment capital plan

Advocate and champion information technology and security strategy, and investment (budget) to full Pension Board

IT Mission and Core Values

Business Resiliency and Continuity

Put Members First

Protect SERS Information

Be Agile and Innovative

Stewards of IT Assets

Information Technology

…In harmony with the SERS 5 Year Strategic Plan

“The greatest danger in times of turbulence is not the turbulence; it is to act with yesterday’s logic,” as management guru Peter Drucker previously warned enterprise leaders.

IT – Guiding Principles

IT Operating Model

Leadership || Governance || Strategy

• Strategic Planning

• Business Analysis

• Quality Assurance

• SMART Release Planning

• SMART Design & Development

• SMART Release Deployment

• Boulevard Development

• Service Desk

• Project Management

• Infrastructure Management

• Information Security

• Telecommunication Management

1

3

8

10

15

0

2

4

6

8

10

12

14

16

Admin Management Plan Build Run

IT Service Delivery

Traditionally, IT delivers services through the combination of – People, Process and TechnologyThis delivery model is enabled by various options.

IT Service Delivery @ SERS

• IT owns ALL processes • Project Management• Caring and Feeding• Patching • etc.

Software Infrastructure

On-Prem SaaS On-Prem IaaS

• SMART• ImageNow• Great Plains• Etc.

• Office 365• Diligent • Policy Manager • Etc.

• Hosts

@ SERS, IT delivers services through the appropriate balance of People, Process and Technology.

• End-Points • Hosts • Telecommunication• Networking etc.

SERS Staff Consultant (When needed)

IT – Infrastructure (Bits and Bytes)

End User 250 End-Points

80 Laptops

30 VOIP

Primary Data Center (HQ)

27 Hosts ~480 Virtual Machines(VM)

~320 TB Storage 28 Networking Gear

5 Firewalls 4 Load Balancers

Software

45 Products

ISP

Verizon100 MB

Spectrum500 MB

Voice

CenturyLinkAvaya Call

Center

SMART

• MARS- Member and Retiree System– 13+ years old– Reaching end of life– Limited Self-Service capabilities

• Decision in late 2010 to replace system– Off the shelf customizable solution– Meet the needs of today and the future (online, self-serve, etc.)– Understand this is a major and complex SERS wide project– Awareness of on-going investment to sustain and enhance system

• SMART in production – February of 2017– Sagitec (vendor) partnered with SERS on a fixed bid project– SERS IT caring and feeding for SMART since March 2018– Core functionality very solid with on-going new capabilities added

SMART Eco-System

SMART

Centralized Printing

ImageNow

Accounting Software

Knowledge Management

Internal Users

Members / Retirees

Internet

Employers

SMART Ecosystem

SMART + Infrastructure = Harmony

Data Center

Network Storage Hosts

Microsoft VMWare ImageNow Other…

Sagitec Proprietary Neospin Framework (Secret Sauce)

Presentation Layer

Business Layer

Persistence Layer

MSS User Internal UsereSERS User

S MART

SMART By the Numbers..• Lines of Code – 269,241• # of Images – 31 Million• Size of the Database – 500GB• # of Screens – 980• # of Correspondences – 687• # of Database Tables – 665• # of Reports – 283• # of Batch Jobs – 243• # of Workflows – 174• # of Outgoing Files - 80• # Incoming Files – 27

SMART Project Financials

• SMART capital project has been closed.• Expenditures were less than capital plan. However, deployment timeline was extended.• Project required extended internal resource commitment to deploy SMART to production.

IS and IT Collaboration

IT

SERS

IS• Security Architecture• Security Controls • Alerts and Monitoring• Permission Management• Incident Management • Security Best Practices

• Security Strategy • Security Awareness Training • Control Testing & Validation • Security Policies • Security Best Practices• Incident Management

• Security Aware Culture • Security Awareness Training

Senior Leadership Oversight (Karen, Joe B. and Jay)

Risk Management - Information Security

Mission:

Safeguard confidentiality, integrity, and availability of SERS’ information systems, identity, and data assets.

Key Objectives:

Align activities with business strategy to support SERS objectivesFoster culture of security awareness and complianceProvide proactive security expertise and identify top cyber risksMonitor threat landscape and implement risk management measures Identify and manage advanced capabilities to protect / detect cyber attacksPlan and manage incident response and BC/DR resiliencyMonitor and report on information security processes and risks

Risk Management – Leadership

Investing in experienced & qualified staff helps SERS establish sustainable programs that add value and systematically address key risks

Information Security, Phil Grim• Over 20 years of progressive information security

leadership roles within a Fortune 500 electric companyand accomplished military security roles

• Led global enterprise and product security program,developed and implemented crisis management plan,centralized security operations, created strategic plan,implemented risk management reporting, vendormanagement compliance to best practices, develop dataprotection compliance program

• Business MBA with information systems concentration;numerous training and certifications as a CertifiedInformation Systems Security Professional, data security,advanced smartphone forensics & incident management

ERM Officer, Susan Bradley• Over 20 years private sector experience within insurance and

health care industries with experience concentrated inenterprise risk management, project management, organizationchange management & software development testing

• Led major projects and programs involving quality, enterpriserisk management, incident response, disaster recovery, andbusiness continuity; excellent knowledge and use of risk tools,such as business impact analysis, risk registers, risk assessmentsand incident tracking analysis

• MBA with multiple certifications as a Risk and InformationSystems Control (CRISC), Business Continuity Professional(CBCP), Six Sigma Black Belt (CSSBB) & Software TestingEngineer (CSTE)

Information Security – NIST Cybersecurity Approach

Understanding Cyber Risks (SERS=100%, Threats=1x)

Cyber risks continue to increase as response times decrease

Focus on threats impacting confidentiality, integrity, or availability of SERS data & systems

SERS is defending itself against well-funded and highly capable threat actors.

Information Security & ERM – Core Responsibilities

Awareness and Education Policy Management Security Governance

Identity and Access Management Risk Assessment Vulnerability

Management

Vendor Management Regulatory Compliance Incident Response

Business Continuity and Disaster Recovery Management

Information Security – Metrics & Measures

Cybersecurity measurement and monitoring will continue to improve to help identify trends and better direct resources

3-Year Information Security Plan

Improving existing processes Awareness & Training - monthly videos, quarterly phishing, frequent

articles Implementing Metrics & Monitoring

FY2021 Key Activities Procured and implemented organizational digital signature solution and

bulk email security enhancements Vulnerability security scans (applications and hardware) to identify,

monitor and report on resolution Improved security with tools for password management, data and system

access, device monitoring, financial data exchange, disability HIPAA data transfer, denial of service attacks, OHSERS website

Partner with IT on Microsoft Office 365 security framework design review and security enhancements addressing November 2019 system outage

Implement a micro-segmentation tool to help prevent data loss Plan security services provider for 24/7 event monitoring and escalation

IS closely aligns with IT staff and leadership - enables security to be positioned at the forefront of new initiatives and emerging risks

QUESTIONS